phoenix_storybook CVE-2026-47068

A victim user must have an active phoenix_storybook playground session with the playground tab open and a ComponentIframeLive iframe rendered and subscribed to its session-specific PubSub topic - the victim's StoryLive LiveView must be actively awaiting an iframe PID announcement. The attacker must have network access to the same phoenix_storybook instance and must know or successfully enumerate the victim's session-specific topic name; topic names follow the predictable pattern psb-component-iframe-<positive integer> (confirmed by test code), making brute-force enumeration feasible against a running instance. The CVSS AT:P modifier confirms these prerequisite conditions are required. Exploitation is strictly limited to the storybook playground session: confidentiality and integrity of variation state, theme, and extra-assign control messages are affected, but there is no remote code execution, no file system access, and no impact on data or systems outside the storybook playground. Deployments where storybook is restricted to a single trusted developer or an internal-only network are not at realistic risk.

The CVSS 4.0 score of 2.3 accurately represents a low-severity finding. The vector AV:N/AC:L/AT:P/PR:N/UI:P indicates network-accessible exploitation with no privileges required, but the AT:P (attack target: partial) qualifier is the decisive limiting signal - exploitation depends on a victim having an active playground session, and the attacker must know or predict the victim's session-specific PubSub topic name. Confirmed impact is limited to low confidentiality (VC:L) and low integrity (VI:L) on the vulnerable system, with no availability impact and no subsequent system impact (SC:N/SI:N/SA:N). No EPSS score was provided in the available data. There is no CISA KEV listing and no public exploit code identified, meaning exploitation status is unconfirmed rather than confirmed safe. Real-world exposure is further constrained by phoenix_storybook's typical deployment as a developer-facing documentation tool on internal or restricted networks - organizations that have inadvertently exposed storybook instances to untrusted users on shared staging environments carry the greatest realistic risk. This is not a high-priority remediation for most teams, but multi-user storybook deployments accessible to untrusted parties should upgrade promptly.

An attacker on a shared development or staging environment where phoenix_storybook is accessible observes or predicts a victim's active playground session topic - topic names follow the pattern psb-component-iframe-<positive integer> as evidenced by the test suite, making enumeration feasible. The attacker loads /storybook/iframe/<any-story>?topic=psb-component-iframe-<guessed-id>, causing their iframe LiveView process PID to be broadcast on the victim's PubSub topic; the victim's StoryLive playground then routes all subsequent control messages (variation state changes, theme switches, extra-assign payloads) to the attacker's process rather than the legitimate iframe. No public exploit code exists at time of analysis.